A rendered namespace is pruned with everything in it, kept claims included #744

Parent

Hand over data to the estate path, blocker W3 on JorisJonkers-dev/estate#216.

What is wrong

The render marks every claim whose Durability Class derives a backup kustomize.toolkit.fluxcd.io/prune: disabled, but writes each Project's Namespace without the mark. Deleting a namespace deletes everything in it, the kept claims included, so the claim's mark protects nothing once the namespace itself is pruned.

On the data handover this is concrete. fleet-infra#562 marks data-system prune: disabled. After the flip, the estate path's kustomize-controller applies the rendered data-system server-side with the same field manager, and the mark fleet-infra wrote is dropped. One prune of the namespace afterwards (a rollback that skips its first step, a render that stops naming the Project) deletes Vault, Postgres, MongoDB and every datastore in it, none of which the claim marks or the Retain reclaim policy then save from the controllers that own them.

What to build

The render marks the namespace it writes kustomize.toolkit.fluxcd.io/prune: disabled, decided in an ADR (every namespace, or only one that holds a kept claim), with the spec, the rendered example trees and a test.

Acceptance criteria

• An ADR records which namespaces carry the mark and why.
• spec/v1 states the rule beside the claim's.
• Every rendered namespace the rule covers carries the mark; a test fails without it.
• The rendered example trees carry it.